When CORS Broke Our Slide Export

The Incident

01

When CORS Broke Our Slide Export

2 / 17

Export failed during live demo

• Bug missed in development

• Surfaced during advisor's first post

• Export button failed — no slides

• Core feature broke in production

When CORS Broke Our Slide Export

3 / 17

The Error

02

When CORS Broke Our Slide Export

4 / 17

CORS blocked image fetch

An image pasted from another site rendered fine, but export failed.

• Image loaded in <img> tag

• Export library fetched via XHR

• CORS policy blocked the request

When CORS Broke Our Slide Export

5 / 17

Root cause: rendering vs fetching

• Image loads in <img> tag

• Fails when fetched programmatically

• Slide export needs binary data

• CORS blocks cross-origin XHR

When CORS Broke Our Slide Export

6 / 17

Image with CORS issue

Displays fine, but fails on export

• Image renders visually

• JavaScript can't read its data

When CORS Broke Our Slide Export

7 / 17

Why Different Behaviors?

03

When CORS Broke Our Slide Export

8 / 17

Why <img> works, fetch fails

• Simple GET request

• Visual rendering only

• No CORS headers needed

• JS can't read binary

• Cross-origin programmatic request

• Missing header blocks request

• Requires Access-Control-Allow-Origin

• JS tries to read image data

When CORS Broke Our Slide Export

9 / 17

Solutions

04

When CORS Broke Our Slide Export

10 / 17

Two possible fixes

Ask host to enable CORS

Move fetching to server

When CORS Broke Our Slide Export

11 / 17

Server-side fetching wins

• CORS doesn't apply server-to-server

• Fetch binary safely

• Send back to client

When CORS Broke Our Slide Export

12 / 17

Hybrid approach chosen

• Keep layout in browser

• Move image fetching to server

• Minimal disruption, max reliability

When CORS Broke Our Slide Export

13 / 17

Lessons & Next Steps

05

When CORS Broke Our Slide Export

14 / 17

Engineering lesson

Rendering is not the same as reading.

Understand browser security boundaries.

When CORS Broke Our Slide Export

15 / 17

Action items

• Show friendly error on export failure

• Load images through server

When CORS Broke Our Slide Export

16 / 17

CORS is a boundary, not a bug

Design for security boundaries from the start

When CORS Broke Our Slide Export

17 / 17